ledgerlive-sd[.]pages[.]dev

This domain, ledgerlive-sd.pages.dev, is actively impersonating Ledger, a cryptocurrency hardware wallet provider, as part of a high-risk brand impersonation campaign. Registered on April 6, 2026, through Cloudflare, Inc., the domain resolves to the IP address 188.114.96.3, hosted in Canada under Cloudflare’s infrastructure. The page title, 'A Step-by-Step Guide to Adding Accounts in Ledger,' directly references Ledger’s services, suggesting an attempt to deceive users into interacting with fraudulent content. Analysis indicates the domain is currently active, returning an HTTP 200 status, and has been flagged by 7 of 94 security vendors on VirusTotal, alongside inclusion on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), and nameservers are saanvi.ns.cloudflare.com and tosana.ns.cloudflare.com, consistent with Cloudflare’s hosting environment. Infrastructure analysis reveals no evidence of a custom phishing kit or advanced evasion techniques, though the use of Cloudflare Pages (.pages.dev) aligns with common tactics to leverage reputable hosting services for credibility. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, recent registration, and security vendor detections warrants immediate defensive action. Defenders should prioritize blocking the domain and IP, monitoring for related infrastructure, and alerting users to the risk of cryptocurrency-related fraud. The domain’s reliance on Cloudflare’s network may complicate takedown efforts, requiring coordination with the hosting provider.